Zyxel has fixed CVE-2026-107441, a flaw in the web management of ten GS1900 switch models that lets attackers run commands without credentials and that, according to Binarly, was exploited as a zero-day against 996 devices. If you run one on firmware 2.90 Patch 2 or earlier, install 2.90 Patch 3 today and remove management from untrusted networks.
Key facts
- What it is: CVE-2026-107441 is an out-of-bounds write in the CGI program of the web management interface. An unauthenticated attacker with network access can execute operating system commands through crafted HTTP requests (BleepingComputer).
- Affected models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2 running firmware 2.90 Patch 2 or earlier. The fixed version is 2.90 Patch 3, for example 2.90(AAHL.3)C0 on the GS1900-24 (The Hacker News).
- Severity: Zyxel rates it CVSS 8.8. Binarly rates it 9.8 and says commands run as root (SecurityWeek).
- The campaign: GreyNoise reported on 21 September that a suspected Chinese-speaking actor, tracked as Kapibala, had compromised 996 switches in 48 countries since around 17 August. 564 of them still had factory credentials.
- Dates: the fixed firmware shipped between 22 and 23 October (sources differ by a day) and Zyxel's advisory came out on 3 November.
Does this affect me if there's a Zyxel in the office cabinet?
If it's a GS1900 on the list and you haven't updated the firmware since late October, yes. These are SMB-grade managed switches, the kind installed in offices, shops and warehouses. The sources give no specific figures for Spain.
The nuance is who can reach the management interface. Zyxel's advisory refers to an unauthenticated «LAN» attacker. Binarly argues that reaching the management service over the network is enough. In practice: if web management is reachable from the internet, from guest Wi-Fi or from any network you don't control, you're exposed.
Why didn't the June patch protect me?
Because it fixed a different flaw. The August campaign was attributed to CVE-2026-7273, which CISA added to its KEV catalogue on 21 September. Binarly confirmed on 28 September that the exploit worked against all ten firmwares already patched for that flaw (Patch 2). It notified Zyxel the next day and Zyxel confirmed the new flaw on 11 October (SecurityWeek).
One caveat: according to The Hacker News, neither GreyNoise nor Binarly says the attacked switches were running the earlier patch. Zyxel's advisory doesn't say whether the new flaw has been exploited either. What is clear is that being on Patch 2 does not protect you from CVE-2026-107441.
Is updating enough?
Not necessarily. In the campaign, attackers took configurations, root credential hashes and network information. Zyxel's advisory doesn't say whether updating removes prior attacker access. Nor does it offer any mitigation for those who can't update. And Binarly says it will soon publish a trimmed-down version of the exploit as a proof of concept, so the window is narrowing.
What to do today
- Take inventory. Find every GS1900 across your sites and note model and firmware version. If you don't know, ask your IT provider or installer today.
- Update. If the firmware is 2.90 Patch 2 or earlier, install the 2.90 Patch 3 build for your exact model.
- Lock down web management. Remove it from the internet and from guest or Wi-Fi networks. Restrict it to a management VLAN or specific admin IPs.
- Change credentials. Get rid of factory passwords. If the device was exposed, also change admin credentials and review the configuration for changes you don't recognise.
- If you can't update today, isolate management from any untrusted network. There's no official mitigation to fall back on.
What it means for an SMB
A switch is the device that gets installed once and never looked at again. This case shows why that's expensive. Anyone who patched in June thought they were covered, and they weren't. And the figure that matters most isn't the CVSS score: of 996 compromised devices, 564 still had the factory password. The flaw opened the door, but poor basic hygiene left it wide open.
Our view: treat network gear the way you treat servers. Up-to-date inventory, current firmware, and management reachable only from an admin network. If the management interface can't be seen from untrusted networks, a flaw like this loses much of its reach, patch or no patch. That doesn't replace updating, but it buys you time the next time a patch arrives late or doesn't work.
If nobody in-house knows what's in your network cabinet, now is a good time to ask your provider for a written list of models, versions and who can access management. If you need help reviewing it, that's exactly what our cybersecurity for SMBs work covers.
FAQ
Am I safe if I already installed the June patch?
No. 2.90 Patch 2 and earlier versions are still affected by CVE-2026-107441. You need 2.90 Patch 3 for your model.
Is there any mitigation if I can't update?
Zyxel doesn't offer one. The sensible step is to isolate web management from any untrusted network and restrict it to a management VLAN or admin IPs.
Does updating kick out an attacker who already got in?
The sources don't say. If the device was exposed, change admin credentials and review the configuration as well as updating.
